ICS - ICS515: ICS Visibility, Detection, & Response

Gain visibility, detection, and response capabilities to protect ICS/OT environments against sophisticated threats including nation-state adversaries targeting critical infrastructure.

ICS515 teaches an intelligence-driven approach to ICS cybersecurity, preparing you to monitor, detect, and respond to threats like STUXNET, CRASHOVERRIDE, TRISIS, and PIPEDREAM.

What You Will Learn:

Threat Intelligence

• Understand ICS threat actors and attack campaigns
• Analyze real-world ICS attacks and malware
• Apply threat intelligence to defensive operations
• Use the ICS Cyber Kill Chain framework

Visibility and Asset Identification

• Build comprehensive ICS asset inventories
• Analyze ICS protocols and network traffic
• Develop collection management strategies
• Map ICS network topologies

Detection and Threat Hunting

• Detect Stage 1 and Stage 2 ICS intrusions
• Hunt for threats safely in OT environments
• Identify control manipulation attempts
• Validate system logic changes

Incident Response

• Perform safe ICS incident response
• Acquire and analyze digital evidence
• Conduct memory forensics on HMI systems
• Analyze PLC logic for root cause determination

22 hands-on labs include building and programming a PLC, operating industrial processes, detecting intrusions, acquiring evidence safely, analyzing phishing attacks, performing HMI memory forensics, and a full-day Capstone challenge.

Students receive a programmable logic controller kit with sector simulation board to keep.

Prepares for GIAC GRID certification (exam sold separately). Ideal for ICS Incident Responders, Threat Hunters, SOC Analysts, and Security Operations personnel.

36 CPE credits. 6 days of expert-led training.